Picture a Monday morning. You unlock the door, flip on the lights, and sit down at your desk. There's a message on your screen you've never seen before. Your files are locked.
You walk to the next desk. Same message. Then the next. Within a few minutes, you're certain of it: every computer in the office is locked. You call your IT team in a panic. They check the server. Locked. Then they check the backups, the one thing that was supposed to save you.
Locked too.
This isn't a hypothetical we invented to get your attention. It's a pattern we've seen with our own eyes, and it's showing up more often than it ever has.
Something changed in 2026
Gemini's owner, Russ Ziskind, has spent decades in IT, and he's watched every wave of threats come through: viruses, then ransomware, then the nastier variants. What he's seeing now is different. Over the last six to eight months, the pace and severity of attacks on small businesses have jumped in a way he describes as unprecedented.
His prediction is blunt: every small business is going to get hit with something that wipes out their computer systems. Every workstation. Every server. Every backup you have.
He calls it an extinction-level event, and he's careful about what that means. It doesn't necessarily mean your company is gone for good. It means that, at a minimum, the business-ending event ends the business for the day. Anything that needs a computer stops. And whether "for the day" turns into "for the week" depends almost entirely on what you did before it happened.
It happens at 3 AM, and that's not an accident
These attacks tend to land in the middle of the night, when nobody's around to notice. That's by design. By the time you walk in and see the message on your screen, the damage is already done and the attackers have had hours to work.
Which is why this isn't something you can solve by being a little more careful.
Locks, deadbolts, and windows
Here's the analogy Russ uses. You put locks on the doors of your house. Maybe you upgrade to deadbolts. That's smart, and you should absolutely do it.
But unless you get rid of every window in the house, there are still ways in.
The same is true for your business. Antivirus, firewalls, and battery backups are all worth having. We install and manage them for our clients every day. But they are prevention, and prevention can't be perfect. Hackers are very good at what they do, and with AI in their toolkit, they're getting better. Eventually, something gets through.
So the real question stops being "how do I stop every attack?" and becomes "what happens to my business when one gets in?"
That's the difference between prevention and preparedness. And preparedness wins.
What preparedness actually looks like
Prevention isn't the enemy here. Russ puts it this way: prevention is a subset of preparedness. You still do the diligent things. You just don't stop there.
Here's what the rest looks like.
1. Backups that can survive the attack
Backups are the crux of everything. But there's an uncomfortable detail most business owners don't know: on-site backups can be wiped out too. We've seen it. Attackers go after the backup systems on purpose, because they know that's what you'd use to recover.
So your backups can't all live in the same place, on the same network, reachable by the same attacker. That might mean a copy that's offline at night, a drive that goes home with someone or into a locker, or, more commonly, a backup service on a completely separate network. It would be highly unusual for both to be hit at the same time.
2. Backups you've actually tested
This is the one that stings.
Russ ran into it again recently, on a call with a company that works alongside Gemini on security. Their observation: they can't count how many times a business believes it has great backups, never tests them, and then goes to restore and finds they aren't what they thought. The files aren't there.
A backup you've never restored from is an assumption. Test it before you need it.
3. A recovery target you chose on purpose
Two questions decide how your backups should be built:
- How fast do you need to be back up?
- How much data can you afford to lose?
For one business, "back by tomorrow morning, and we can live with last night's data" is perfectly fine. For another, it's "back in 15 minutes, and we can't lose more than 15 minutes of work." Both are legitimate answers. They're also very different systems at very different price points.
Russ calls it a dial, and the dial is connected to your money. Turn it toward faster and fresher, and the cost climbs. The point is to decide where it should sit before the bad day, not during it.
4. Cyber insurance that will actually pay
You can't say you'll never be in a car accident, even if you're a perfect driver. There are other drivers on the road. And you can't buy car insurance after the crash.
Cyber insurance works the same way, with one big update: it's not your father's cyber insurance. Policies sold a couple of years ago were cheap and easy. You signed a form saying you were doing all the right things and promised you meant it. The problem: if you weren't actually doing those things, your claim may not be covered. And even when it was, the coverage was thin.
Today's policies are harder to get. You have to prove your controls, often with screenshots, and your IT provider may need to sign off that the safeguards are really in place. In exchange, the coverage is much stronger, including forensic teams that step in and a single call to make when you're in the middle of an incident. A good policy works alongside your managed service provider, not instead of one.
Five questions to ask this week
You don't need to boil the ocean. Start here, and write the answers down:
- 1Where do our backups live, and could the same attack that hits our computers reach them?
- 2When did we last restore something from backup, not just run one?
- 3How long can we be down, and how much data can we lose? Has anyone ever decided that on purpose?
- 4Do we have cyber insurance, and could we honestly pass the application today?
- 5Who is watching our systems at 3 AM?
If any of those answers is "I don't know," that's not a failure. It's a starting point. It's also exactly the gap an attack finds.
Why we start with backups
At Gemini, we say something that surprises people. When a new client assumes we'll start by selling them new computers or servers, we tell them: we won't sell you a mouse until your backups are in place.
It isn't a sales tactic. It's the same belief this whole post is built on. You're going to get hit, and there's nothing that can fully prevent it. So the first job is making sure that when it happens, it's a bad day instead of the end of the road.
We've been doing this for small businesses in Rochester and across Western New York since 1994, and we treat your network like our own.